one-detail-reads-person-video-gen

Create vertical social-read shorts: one-cue thesis, example beat, playful closer, timed English captions (WeryAI). Use for psychology hooks, micro-behavior r...

This skill appears coherent for generating short vertical videos with WeryAI. Before installing or running it: (1) Review scripts/video_gen.js yourself (or have a developer review it) if you plan to pass any local file paths — the script will read those files and upload them to an external WeryAI upload endpoint using your WERYAI_API_KEY. (2) Prefer supplying public https image URLs to avoid local uploads. (3) Use a least-privilege or short-lived WERYAI_API_KEY and avoid sharing other credentials. (4) Do not provide images of private individuals or non-public figures without consent; the SKILL.md already warns about privacy and content boundaries. (5) Ensure Node.js 18+ is available. If you cannot review the code or do not want any file reads/uploads, decline local-path usage and only provide public https image URLs or text-only prompts.

Type: OpenClaw Skill Name: one-detail-reads-person-video-gen Version: 1.0.0 The skill bundle contains a Node.js script (`scripts/video_gen.js`) that facilitates video generation via the WeryAI API. A significant risk is identified in the script's `uploadFileToPublicUrl` function, which reads local files using `fs.readFile` and uploads them to a remote endpoint (`api-growth-agent.weryai.com`) to support image-to-video tasks. While this behavior is documented and includes instructions for the agent to seek user consent, the script lacks path sanitization or directory whitelisting, creating a potential vector for arbitrary file exfiltration if the agent is manipulated via prompt injection to provide sensitive system paths (e.g., SSH keys or environment files) as image inputs.